Falhas do tipo CWE-428

356 resultados

Caminho de busca sem aspas ou elemento desprotegido

Ocorre quando um programa busca executar um arquivo ou carregar uma biblioteca sem aspas no caminho, ou sem validar o local exato. Um atacante coloca um arquivo malicioso em um diretório anterior da busca, forçando o programa a executar o arquivo dele em vez do legítimo.

Exemplo

Um instalador Windows tenta executar 'C:\Program Files\Aplicacao\bin\tool.exe' sem aspas. Se o caminho contém espaço e o programa busca executáveis também em diretórios do sistema, um atacante cria 'C:\Program.exe' que será carregado antes.

Como mitigar

Use caminhos absolutos com aspas duplas em toda chamada de programa ou biblioteca (ex: '"C:\\Caminho Completo\\arquivo.exe"'). Valide e normalize todos os caminhos dinâmicos antes de usar, rejeitando qualquer que não corresponda exatamente ao esperado.

CVE-2020-36990HIGHInput Director 1.4.3 - 'Input Director' Unquoted Service PathEPSS 0.2%CVE-2021-47985HIGHBrother SAPSprint 7.60 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2024-5963MEDIUMAn unquoted executable path exists in Hitachi Device ManagerEPSS 0.2%CVE-2016-20091HIGHWindows Firewall Control 4.8.6.0 Unquoted Service Path Privilege EscalationEPSS 0.2%CVE-2025-43993HIGHDell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or EPSS 0.2%CVE-2019-25288HIGHWacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service PathEPSS 0.2%CVE-2024-31201MEDIUMA “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenariosEPSS 0.2%CVE-2026-2542HIGHTotal VPN win-service.exe unquoted search pathEPSS 0.2%CVE-2019-25292HIGHAlps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service PathEPSS 0.2%CVE-2021-47882HIGHFreeLAN 2.2 - 'FreeLAN Service' Unquoted Service PathEPSS 0.2%CVE-2020-37045HIGHNetBackup 7.0 - 'NetBackup INET Daemon' Unquoted Service PathEPSS 0.2%CVE-2020-36952HIGHIObit Uninstaller 10 Pro - Unquoted Service PathEPSS 0.2%CVE-2020-37048HIGHIskysoft Application Framework Service 2.4.3.241 - 'IsAppService' Unquoted Service PathEPSS 0.2%CVE-2020-37047HIGHDeep Instinct Windows Agent 1.2.29.0 - 'DeepMgmtService' Unquoted Service PathEPSS 0.2%CVE-2020-37062HIGHDHCP Turbo 4.6.1298- 'DHCP Turbo 4' Unquoted Service PathEPSS 0.2%CVE-2020-37055HIGHSpyHunter 4 - 'SpyHunter 4 Service' Unquoted Service PathEPSS 0.2%CVE-2020-37037HIGHAVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service PathEPSS 0.2%CVE-2020-37064HIGHEPSON EasyMP Network Projection 2.81 - 'EMP_NSWLSV' Unquoted Service PathEPSS 0.2%CVE-2025-8070CRITICALWindows service registered with an unquoted ImagePath vulnerability in the system registryEPSS 0.2%CVE-2025-12247HIGHHasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search pathEPSS 0.2%